Buyers ask about regulation in two ways. Legal asks which laws apply. Operations asks what the agent has to do differently because of them. This guide answers the second question, because a law that does not turn into a control the system reads is a document, not a safeguard.

The EU AI Act, after the 2026 Digital Omnibus

The dates moved in 2026. As published in the Official Journal in July 2026:

• 2 February 2025: the prohibited practices applied.
• 2 August 2025: obligations for general-purpose AI models applied.
• 2 August 2026: transparency duties applied, including telling people they are interacting with an AI system.
• 2 December 2027: obligations for high-risk systems listed in Annex III, such as credit scoring of individuals and employment decisions. This was 2 August 2026 before the Omnibus.
• 2 August 2028: obligations for high-risk systems covered by existing EU product law (Annex I).

From obligation to control

The standards

ISO/IEC 42001:2023 is a certifiable management-system standard for AI. It certifies the organisation’s processes, not an individual agent, and it is a good frame for showing a regulator that AI is governed as a system. The NIST AI Risk Management Framework organises the work into four functions: govern, map, measure and manage. Neither tells you how much autonomy a specific agent should have for a specific action; that is the gap depth certification fills.

Data and sector rules, wherever you operate

Every market adds its own layer. Data protection law (the GDPR and UK GDPR, US state privacy laws, Nigeria’s Data Protection Act 2023, Singapore’s PDPA and others) governs personal data, often including rights around automated decisions. Financial supervisors govern what a bank or payment firm may do with customer money and data, whoever performs the work. The pattern is the same everywhere: the law sets the outcome, and the agent platform has to show the control that delivers it.

This guide explains how obligations map to controls. It is not legal advice, and the classification of a specific system should be confirmed with counsel.

Provider or deployer: who carries which duty

The EU AI Act separates the provider, who builds and places an AI system on the market, from the deployer, who uses it in their business. Both carry duties for high-risk systems. Providers must, among other things, build in risk management, logging and human oversight. Deployers must use the system as instructed, assign human oversight to competent people, monitor it in operation and keep the logs it produces. In practice a business deploying agents needs a platform that makes its own deployer duties easy to meet and prove.

A control checklist for buyers

Whatever the jurisdiction, these controls answer most of what regulators and auditors ask:

• Every agent has a stated role with a ceiling that cannot be raised by configuration.
• Authority is granted at a depth, on evidence, and lapses unless re-earned.
• Actions one depth above the agent’s authority are held for a named person; further above, they are refused.
• Every action, hold and refusal is recorded with the rule that applied.
• The agent reads only approved sources, and every answer cites one.
• People are told when they are dealing with an AI system.
• Personal data is limited to what the role permits, and every decision, reads included, is recorded.
• Someone outside the vendor can inspect the record.

Keeping up as dates move

The 2026 Omnibus showed that AI law will keep moving. Design for the outcome rather than the date: a platform that already enforces oversight, logging and earned authority does not need rebuilding when an obligation is brought forward or pushed back. We update this guide when the law changes, and the date at the top of this page is the date it was last checked.

Questions people ask